Updating MySQL database with MD5 value - php

Question

Having searched thoroughly through my code, the only reason that I could determine for this error is that the technique I am using for converting the string to MD5 is invalid. However I cannot find another way to do so.
$username = $_POST['username'];
$password = $_POST['password'];
$repassword = $_POST['repassword'];
if( $password=$repassword ) {
$con=mysql_connect("localhost", "root", "");
if( $con == true ) {
mysql_select_db("movedb", $con);
//$newpassword = mysql_real_escape_string(md5($_POST['password']));
$query = "UPDATE user SET password=MD5('$password') WHERE username='$username'";
// $query = "UPDATE user SET password='$newpassword' WHERE username='$username'";
$result = mysql_query($query, $con);
if( $result == true ) {
echo "Successfully saved your message";
} else {
echo mysql_error();
}
mysql_close($con);
} else {
echo "Cannot connect to the database";
}
} else {
echo "Passwords do not match!";
}
Any ideas on how to update this MD5 value from PHP

Answer 1

$password = md5($password);
$query = "UPDATE user SET password='".$password."' WHERE username='".$username."'";
Use PHP supported md5 hash.

Answer 2

An issue that can cause problems is that MySQL and PHP use different default salts when they encrypt. This means that the resulting strings will be different. So you have to use either PHP or MySQL to encrypt and not a mixture of the 2.
Secondly, MD5 has been superceded by other better encryption algorithms. You might consider using one of those for improved security. Check out PHP's crypt() function.

Answer 3

To check the password:
SELECT * FROM 'user' WHERE username='bob.jhonny' AND pass=MD5('oldPassword');
To update:
UPDATE 'dlp_contatcs'.'user' SET 'Pass'=MD5('NewPassword') WHERE 'Username'='bob.jhonny';

Answer 4

Warning:
Please, don't use mysql_* functions to write new code. They are no longer maintained and the community has begun the deprecation process. See the red box?
Instead, you should learn about prepared statements and use either PDO or MySQLi. This article should give some details about deciding which API to use. For PDO, here is a good tutorial.
You can calculate the md5() hash with PHP and store it into a variable, then put that variable into the database. Just make sure you do the same conversion (md5 in the PHP code body) when checking against the database.
You should fix the line if( $password=$repassword ). You need either two or three = signs to make the if check against something. The proper line would be if( $password === $repassword ).
// ...
$newpassword = md5($_POST['password']);
$result = mysql_query('UPDATE user SET password="' .mysql_real_escape_string($newpassword). '" WHERE username = "' .mysql_real_escape_string($username). '"', $con);
if ( $result === TRUE )
{
echo "Successfully saved your message.";
// ...